Create a break-glass email account for Fallout

## Problem
Every org-owned Fallout account (Cloudflare #234, project comms #233, nuget.org #185) needs an account-recovery / owner address. Two traps to avoid:
- **Circular dependency** — if the recovery address routes through infrastructure Fallout itself runs (e.g. `*@fallout.build` via the Cloudflare zone's Email Routing), a lockout or zone outage becomes unrecoverable.
- **Person ownership** — a recovery address tied to a maintainer's personal inbox re-couples the project to one person, defeating the whole org-ownership milestone.

## Outcome
A dedicated **break-glass mailbox** that is independent of any Fallout-run service and shared across maintainers — the emergency-access / recovery address for all org-owned accounts.

## Acceptance criteria
- Mailbox on an **external provider** with real MX **not** routed through the fallout.build Cloudflare zone, Workers, or Email Routing.
- Credentials + 2FA seed / backup codes stored in the maintainer-only store (not a personal password manager).
- Access held by **≥2 maintainers**; no single person is the sole holder.
- Registered as the recovery / owner address for: Cloudflare account (#234), comms inbox (#233), nuget.org org (#185).
- Used only for break-glass recovery — not for day-to-day project mail (that stays on the CF-routed addresses like `security@`).

## Blocks / coordinate with
- #234 (Cloudflare migration) — this is the account-recovery address there
- #233 (org-owned comms accounts) — same recovery role
- #185 (nuget.org org account) — same recovery role